Publish curated Unraid-AppOps-Gateway source from 6d175c3333218e2b580a310496fed6c407f28114

backend/tests/test_appops_recovery_deploy_binding.py

@@ -1135,3 +1135,36 @@ def test_followup_transaction_journal_failure_precedes_all_source_runtime_and_st
     assert [event[0] for event in events] == ["green", "snapshot", "backup", "journal"]
     assert marker.read_text() == "prior source remains\n"
     assert state["live_revision"] == prior_revision
+
+
+
+def test_prepare_restored_recovery_rechecks_signed_live_state_and_recaptures_under_new_id(
+    deploy, monkeypatch, tmp_path,
+):
+    case = _appops_prepare_recovery_case(deploy, monkeypatch, tmp_path)
+    calls = []
+
+    def verify(_project, container, image, **kwargs):
+        calls.append(kwargs)
+        assert container["Id"] != deploy.APPOPS_LEGACY_OLD_CONTAINER_ID
+
+    monkeypatch.setattr(deploy, "verify_appops_legacy_runtime", verify)
+    deploy._appops_prepare_recovery(
+        case.project, APP_OPS_REPOSITORY, case.repo, case.revision, case.metadata, case.state,
+    )
+    assert calls == [{"require_original_container": False, "recovery_state": case.state}]
+    assert case.calls["models"][0][0] == RECOVERY_ID
+    assert case.calls["models"][0][2]["services"]["appops-gateway"]["environment"] == case.values
+    assert case.project["_compose_rollback"]["containers"][0]["container_id"] == case.container["Id"]
+
+
+def test_prepare_recovery_rejects_environment_drift_before_model_backup_or_transaction(
+    deploy, monkeypatch, tmp_path,
+):
+    case = _appops_prepare_recovery_case(deploy, monkeypatch, tmp_path)
+    case.container["Config"]["Env"].append("UNEXPECTED_SETTING=private-sentinel")
+    with pytest.raises(deploy.DeployError, match="complete runtime environment changed"):
+        deploy._appops_prepare_recovery(
+            case.project, APP_OPS_REPOSITORY, case.repo, case.revision, case.metadata, case.state,
+        )
+    assert not any(case.calls[name] for name in ("models", "capture", "backup", "begin"))